Chrome Enhanced Protection Adds ClickFix Clipboard Command Checks for Windows Users

Google announced the change on October 20, 2026, in a Chrome Security post by Jasika Bawa, Group Product Manager for Chrome. The post covers three Safe Browsing updates, all for users who turn on Enhanced Protection:

• A new "suspicious site" warning, below the existing red "dangerous site" page
• Scam detection that moves from Gemini Nano on your device to a larger Gemini model on Google's servers
• Detection of ClickFix commands that you copy from a webpage

What ClickFix is and why Windows users should care​

ClickFix pages show you a fake problem, like a broken CAPTCHA, a "browser error" or a pretend security alert. They then tell you to "fix" it by pasting a command into the Run box or a terminal. Help Net Security notes that the copied command can differ from the one displayed on the page. The text you see looks harmless. The page quietly puts something else on your clipboard.

The commands usually run tools that come with Windows. They often invoke living-off-the-land binaries (LOLBins), legitimate tools and executables preinstalled on an operating system, such as PowerShell and cmd.exe. Attackers repurpose them to download and install malware, conceal their activity, and take advantage of the trust security software places in them.

This is why browsers have struggled with it. Chrome's download protections look at files coming through the browser. In a ClickFix attack, the malware is fetched by PowerShell after you paste the command, so the browser never handles the download. Help Net Security puts it this way: moving the download process from the browser to the terminal allows attackers to bypass Chrome and Safe Browsing download protections.

Business networks are targets too. SecurityWeek reported a variant called "CrashFix", found by Huntress. A malicious extension pretending to be uBlock Origin Lite silently copies malicious PowerShell commands to the clipboard, masquerading as a repair command, designed to infect the victim's system with ModeloRAT. In that campaign, only hosts that are domain-joined are infected, which suggests that the threat actor behind the campaign, dubbed KongTuke and active since at least early 2025, is targeting corporate environments.

Summary: ClickFix gets around browser defenses by getting you to run the malware yourself, using built-in Windows tools. That's the gap Google is trying to close.

How the clipboard check works​

Here's how 9to5Google describes the process: when a potential ClickFix script is copied, Chrome will remove personally identifiable information from the clipboard and send it to Safe Browsing for further analysis. The browser shows a warning if the analysis decides the command is dangerous. Google says the system is "designed to be high precision" so it can protect people in real time without getting in the way of legitimate developer work.

Some things are clear and some aren't:

Be careful with Google's privacy promise. The line that content is "never logged, retained or used to train models" appears in the section about page-content scam analysis. Google doesn't apply that wording to clipboard payloads. They may be handled the same way, but the announcement doesn't say so.

Google isn't the first to try clipboard-based defenses. Eye Security already offers a Chrome extension called ClickFix Block. It scans copied content for suspicious keywords (e.g., powershell, mshta, "not a robot") and displays warnings or blocks the copy before malicious commands reach your clipboard. The approaches differ. The extension matches keywords inside the page. Google's version checks the command on its servers, which could catch tricks a keyword list would miss. The trade-off is that the copied text leaves your PC.

Two levels of site warnings​

The second change splits site warnings into two levels. Google says "suspicious" means a lower-confidence verdict with possible risk of harm. "Dangerous" means a high-confidence verdict with high risk. According to 9to5Google, suspicious sites (above) will trigger a shield icon in the Omnibox, with a dialog box letting you "Mark as safe" or go "Back to safety." Dangerous site alerts (below) will continue to appear as a "full-page red interstitial warning."

Google's reasoning is that a gentler warning lets Chrome flag more pages without blocking the screen every time it has a hunch. Google says the suspicious warnings look different from the red page, with their own format, icons, color and text. Microsoft Edge users will find this familiar, since SmartScreen has long separated "unsafe" from "unrecognized." The risk is warning fatigue. If the shield icon shows up too often, people will learn to click "Mark as safe" without reading.

Scam detection moves to Google's servers​

In May 2025, Google announced that Chrome 137 would use the on-device Gemini Nano model to spot tech-support scams. Certain triggers, such as a page using the keyboard lock API, would prompt Chrome to analyze the page locally. Only the resulting security signals went to Safe Browsing, and only for Enhanced Protection users. That approach needed a capable device.

Google now says it has switched to a more powerful Gemini model on its servers. The goal is to cover all Enhanced Protection users and more kinds of scams. As 9to5Google summarizes, this protects Enhanced Protection users from a broader range of threats, including fake antivirus and browser update scams. Google says the model looks at things like which brand the page claims to be, what the page is trying to do, and a scam-likelihood score. Safe Browsing then combines that with domain reputation and other signals to reach a verdict.

There is a privacy trade-off. The old design kept page analysis on your machine. The new one sends page text to Google, though Google says it does this only when a page shows high-confidence scam signs, and that the text is handled "ephemerally." Google gives no technical details beyond that promise and doesn't mention any independent audit.

The "ten times safer" figure​

Google says Enhanced Protection users are "ten times safer" than Standard Protection users against phishing, social engineering, notification abuse and other scams. Google's own footnote explains that the figure compares the average number of safety warnings shown to each group. It measures how many warnings people saw, not how many attacks succeeded. It's a reasonable sign that Enhanced Protection catches more, but it doesn't prove users suffered one-tenth the harm.

Should you turn it on?​

Enhanced Protection checks pages in real time, and in return it sends Google more data. Google's help documentation says it may send URLs, small samples of page content, extension activity and system information to Safe Browsing. The new features add page text and flagged clipboard commands to that list.

To turn it on: Google's help page gives these steps for Android: open Chrome, tap More → Settings → Privacy and security → Safe Browsing, then choose Enhanced protection. Desktop Chrome also keeps Safe Browsing settings under Privacy and security, but the page we checked only listed the Android steps.

For IT admins: Treat this as one extra layer, not your main defense. Practical steps include:

1. Telling users that no real website will ask them to paste commands into Win+R, PowerShell or Terminal. Google's own example image says Chrome "will never ask you to repair it in this manner!"
2. Using endpoint controls to watch for PowerShell and mshta being launched from the Run dialog.
3. Reviewing Chrome extensions, since CrashFix shows that fake extensions can deliver ClickFix lures too.

The bottom line​

The headline about Chrome watching your clipboard is technically accurate but makes it sound broader than it is. Google has added a narrow check to an optional mode, aimed at an attack that slips past traditional browser defenses. The main gaps are disclosure: how the PII scrubbing works, how long clipboard text is kept, and how often legitimate commands get flagged. Admins who want to deploy this widely will want answers on all three.